How traceroute Really Works: TTL, ICMP Time-Exceeded, and Mapping a Path Hop by Hop

Originally published at series.

This post is part of Protocol Lab, a free, hands-on series for learning networking protocols by building and breaking them in a container lab. All the lab material — topologies, configs, and scripts — lives in the repo:

Prerequisite:

Verified Run Log (2026-07-07)

This lab has been confirmed reproducible on real hardware.

Environment:

• Ubuntu 26.04 LTS (kernel 7.0.0-27-generic, x86_64)


• Docker 29.1.3


• containerlab 0.77.0


• client / r1 / r2 / server: nicolaka/netshoot:latest (traceroute, tcpdump included)

Running PATH="/tmp/pl-shim:$PATH" ./scripts/labctl.sh run trace-19 performed deploy → verify → destroy, and verification.json returned "status": "verified".

traceroute maps the path hop by hop

$ docker exec clab-trace-19-client traceroute -I -n 10.0.3.2

traceroute to 10.0.3.2 (10.0.3.2), 30 hops max, 46 byte packets

 1  10.0.1.2  0.003 ms     <- r1

 2  10.0.2.2  0.001 ms     <- r2

 3  10.0.3.2  0.000 ms     <- server (destination)

The TTL mechanism: ICMP time-exceeded comes back from each router

$ docker exec clab-trace-19-client tcpdump -n -vv -r icmp.pcap

10.0.1.2 > 10.0.1.1: ICMP time exceeded in-transit, length 92   <- TTL 1 dies at r1

10.0.2.2 > 10.0.1.1: ICMP time exceeded in-transit, length 92   <- TTL 2 dies at r2

The TTL=1 probe hits 0 at the first router, r1 (10.0.1.2), and r1 returns a time-exceeded. The TTL=2 probe dies at r2 (10.0.2.2). traceroute maps the path by exploiting exactly this "one router answers per distance" behavior — a simple loop-prevention field turned into a path-visualization tool.

Cleanup

containerlab destroy -t trace-19.clab.yml --cleanup

That's traceroute: no dedicated discovery protocol, just TTL doing its loop-prevention job and every router along the way announcing itself as it drops your probe.

Explore the full Protocol Lab series here: github.com/pathvector-studio/protocol-lab. If these labs are useful to you, please ⭐ star the repo on GitHub — it genuinely helps others find the project.

Next up, we'll keep pulling packets apart — from mapping paths to watching what protocols do at each end of them.